Jpeg xl: libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata… (CVE-2026-82522)

The vulnerability in libjxl versions prior to 0.12 involves an integer underflow in the container box parser. On 32-bit platforms, the 64-bit box size is truncated to size_t, which can be exploited by attackers supplying specially crafted JPEG XL files. This causes the decoder to parse attacker-controlled codestream bytes as phantom box headers, allowing injection of arbitrary metadata formats (Exif, XMP, IPTC, JUMBF) and potentially triggering out-of-bounds reads.

Attackers can remotely inject arbitrary metadata into JPEG XL files processed by vulnerable libjxl versions on 32-bit platforms. This may lead to integrity issues with metadata and potential out-of-bounds memory reads, which could affect application stability or security. The CVSS score of 5.4 indicates a medium severity impact with low confidentiality and integrity impact, and no availability impact.

A fix is available in libjxl version 0.12 and later. Users should upgrade to version 0.12 or newer to remediate this vulnerability. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes.